edschweppe | Hexaphisimal notation

I get the occasional phishing email - of course, since I set Thunderbird to display in plain text, the phishy stuff is pretty obvious. But yesterday, I got one where all the purported ebay.com URLs were actually going to aitch-tee-tee-pee-slash-slash 0xdc.0x50.0x21.0xc9 slash whatever - which, if my hex-conversion and DNS lookup skills are any good, is somewhere in South Korea.

I forwarded it to spoof@ebay.com, and they just replied:

The email you reported was not sent by eBay. We have reported this email
to the appropriate authorities.

Maybe they'll catch themselves a phisherman ...